On Seismic Design Qualification of NPPs After Fukushima Event in Japan

Transcription

1 On Seismic Design Qualification of NPPs After Fukushima Event in Japan T. Takada Graduate School of Engineering, the University of Tokyo, Japan SUMMARY A seismic design guideline for nuclear power plants (NPP) in Japan has been revised in 2006, where one of the major revisions is to add a statement of residual risk which has never been stated explicitly so far. In July 2007, there occurred the Niigata earthquake, where not much serious damage were reported although observed acceleration records greatly exceeded the design level. In March 11, 2011, the Fukushima Daiichi Plant was heavily damaged by huge earthquake and the following tsunami, and its consequence has been unexpectedly enormous due to radioactive release from four nuclear reactors. After these serious experiences, seismic design as well as assessment have been of major concern, and regulatory authorities, utilities and scientists have been intensively working on seismic qualification of existing NPPs. In the present paper, it is reported how current relevant activities have been done and it is discussed what are key issues. Keywords: seismic design qualification, stress test, residual risk, nuclear power plants. 1. INTRODUCTION Seismic safety of NPPs in Japan is the most important issue and tremendous efforts have been made for evaluating, quantitatively assessing and improving if necessary for more than forty years. In 2006, a seismic design guideline for NPPs has been revised (NSC, 2006), indeed, 25 years after the last major revision was made in 1981 (Kato et al., 1989). During such a long period of the more than two decades, many large events including the 1995 Kobe earthquake have been experienced and ample findings and lessons learned have been accumulated so far. Under such background, a Nuclear Safety Commission (NSC) in Japan decided to hold a special committee to revise the old guide in 2001, then after five years the guide has been revised, which was the year just before the Niigata earthquake mentioned below. All revised key issues are clearly related to uncertainty lying in the whole design process. Improved methodologies have been adopted to reduce uncertainty including of improvement of accuracy, and to partially adopt probabilistic approaches to evaluate residual risk since uncertainty cannot be fully eliminated. In 2007, the Niigata-ken Chuetsu-oki earthquake (the Niigata earthquake, hereafter) struck the Kashiwazaki-Kariwa NPPs. The plants were safely shutdown with minor damage on non-critical facilities and components. It should be noted that the record observed on the base-mat of the reactor building exceeded the design level by twice and more, but the plants showed excellent performance against the unexpectedly large seismic excitation. It is attributable to the potential seismic margin of structures and components in addition to originally designed margin. After more than two years from the event, a unit No.7, a newest unit, begun to operate. The 2011 Great East Japan Earthquake (the Tohoku earthquake, hereafter) has brought a tremendous disaster to Japan, Earthquake, Tsunami, and the Fukushima NPP accident, all of which have resulted in large and long-lasting consequence to the modern society. In March 11, 2011, the Fukushima Daiichi NPP was heavily damaged by the huge earthquake and the following tsunami, and its consequence was unexpectedly enormous due to radioactive release from four nuclear reactors at the site. It was

2 surprising that the NPPs were found to be very vulnerable against natural hazard although severe conditions were combined. From engineering point of view, however, the safety of the NPP should have been secured against such a severe condition. After these serious experiences in Japan, seismic design as well as safety assessment have been of major concern, and regulatory authorities, utilities and scientists have been intensively working on seismic qualification of existing NPPs. The paper discusses the impact on the current seismic design guide and future research needs for more rational design guide and demonstrates how these recent events have influenced another revision of design guidelines, design practices and licensing process (Takada, 2010; 2012). 2. RECENT EVENTS OF NPP IN JAPAN 2.1. Kashiwazaki-Kariwa NPP in 2007 Niigata Earthquake The Kashiwazaki-Kariwa NPP, which is located, in the Niigata prefecture, in the northwest of Japan, was struck July 16, 2007 by the Niigata-ken Chuetsu-oki Earthquake and all reactor units under full power operation were automatically safely shutdown. Although the earthquake significantly exceeded more than double the level of the seismic input taken into account in the design of the plants, the installation behaved in a safe manner during and after the earthquake. The official statement of NSC is: The main reason why seismic safety of the facility was successfully assured despite of the large magnitude of ground motions. Some experts think that although most of damage was concentrated on the seismically minor equipments and ground, the plant behaved successfully and the classification of seismic safety importance was verified as effective concept (Takada, 2008). Many experts, however, feel that there still is extremely large uncertainty for identifying earthquake sources as well as estimating future ground motions. Seven units of the KK NPP were stopped and the newest Unit 7 was restarted in operation in 2009, that is indeed around two full years after the event, during the past periods, the electric utility had to request neighbouring electric utilities to transmit electricity and re-operate the thermal power plants. This raised the significance of operability of the plants, namely, stable electricity supply. It can be thought that from the viewpoint of performance-based seismic design, safety must be of course understood as most prioritized fundamental performance, but other required performance rather than safety requirement, such as operation continuity or immediate recovery may become one of important performance goals for seismic design of NPP. One thing among various experiences in the Niigata earthquake that can make ourselves more confident about the design guide is, indeed, that the plant including structures and components exhibited much greater safety margin than expected against such an excessive dynamic shaking. The plant designed accordingly possesses great seismic margin which later should be quantified in a future in light of the fact experienced in the event (IAEA, 2003) Fukushima Daiichi NPP in 2011 Tohoku Earthquake The gigantic 2011 Great East Japan Earthquake occurred with an earthquake magnitude 9.0, which is the super mega earthquake from the Japanese observation history, and its earthquake source region in the plate boundary ranges 500 km in North-South length and 200km width in East-West direction. The spatial distribution of JMA intensity at the Tohoku region is plotted in Fig.1, and the regions with JMA intensity 5 greater to intensity 6 greater are quite wide coastal area. In a Tokyo Metropolitan area, the wide area was shaken with JMA intensity 5 greater and the long duration time of shaking, say, 2 minutes was observed. Furthermore, so may aftershocks including earthquake magnitude 7.0 followed. Figure 2 shows the epicenters of the aftershocks in two months after March 11, and most of aftershock earthquakes with more than magnitude 7.0 occurred much closer to the land, which might have produced larger ground motions to some areas than that from the main shock did.

3 March 11 to May 13, 2011 M=9.0 Figure 1. JMA intensity (ADEP, 2011) Figure 2. Location of aftershocks (ERI, 2011) The huge tsunami hit the very wide area, 500 km long the Tohoku coast, and tsunami wave height observed varied from 6 to 40 meters, dependent upon topography of coast and configuration of bay areas. It resulted in around 20,000 people dead and missing, and 2, 350 thousand houses flashed away. The number of casualties, region by region, seems to be highly dependent on the location of the region and their emergency evacuation plan against tsunami, rather than presence of tidal embankments constructed. The spatial distribution of tsunami height compiled by a special investigation group is shown in Fig. 3 (Joint Investigation Group, 2011). A region with no dots in the figure is close to the Fukushima NPP where tsunami height data were not collected because of radioactive controlled area. This figure clearly shows that very wide area were affected by tsunami and the tsunami height close to 40 meters were observed, which are found much larger than the height of embankment in some regions. Figure 3. Spatial distribution of wave height (Joint Investigation Group, 2011) A nuclear accident has occurred at the Fukushima Daiichi NPP as the result of the giant earthquake and tsunami of the Great East Japan Earthquake. It was a typical multiple hazard disaster to the plant, where there were large ground shaking and the following tsunami wave, both of which affected the

4 plant. While the details of the accident still remain to be fully determined, the accident is outlined below from the viewpoint of the three rules for ensuring safety of nuclear power plants during nuclear plant emergencies, i.e. Stop, Cool down, and Confine (Takada, 2011). As the result of the ground shaking during the Great East Japan Earthquake that occurred on March 11, 2011, control rods were firmly inserted into the cores of reactors No. 1, 2, and 3 of the Fukushima Daiichi NPP, which were operating at the time of the earthquake, as part of the automatic shutdown procedure, and thus the first rule of "Stop the reactor" was accomplished. However, as a result of the earthquake, off-site electric power was rendered impossible, and thus the plant's emergency diesel generators were activated and the emergency core cooling systems began operating. Approximately one hour later after the earthquake, a giant tsunami of about 14 meters in height hit the plant, incapacitating diesel generators and seawater pumps, making it impossible to remove the decay heat of the core fuel to cool it down. Despite water injection into the reactors, fuel failure occurred. Some damage to the pressure vessels and containment vessels is deemed to have occurred, and hydrogen explosions occurred due possibly to the accumulation of hydrogen within the reactor buildings. As a result, radioactive material has been released from the reactor buildings and reached areas outside the plant's premises. In other words, cooling and containment of the nuclear reactors were not achieved, and as a result, radioactive material from the plant has been released to areas outside the plant site and contaminated surrounding areas. All-out efforts to bring under control the situation at the Fukushima Daiichi NPP are still currently in progress. 3. SUMMARY OF CURRENT SEISMIC DESIGN GUIDELINE OF NPPS IN JAPAN The basic requirement of the current seismic design review guideline of nuclear facilities, which was revised in 2006, states (NSC, 2006), To avoid any risks of serious radiological exposure to the public in the vicinity of the Facilities due to the external disturbance initiated by an earthquake, by appropriately formulating the ground motions for the seismic design, which could be postulated appropriately to occur with a very low probability during the service period of the Facilities and which could seriously affect the same. The basic principle regarding seismic safety is the same as the previous one (Kato et al., 1989), however, the probabilistic statement such as a very low probability during the service period of the facilities has been adopted in the current guideline, which is the quite contrast to the design requirement statement of absolute safety of the previous one. This indicates the current guideline adopts the probability concept into the seismic design since there exists large uncertainty in the phenomena of earthquakes. The most important attitude towards achieving safer NPPs is to do every effort to recognize, to identify and to assess various uncertainties in all engineering processes. Furthermore, the guideline continues to mention use of PSA (Probabilistic Safety Assessment) of NPPs with the concept of residual risk. It requests that: the operators strive to minimize the residual risk as far as practically affordable; and also outlines the exceedance probabilities of the design basis ground motion to be referred to in each safety review case. It continues to state that approaches based on the residual risk will lead to future risk-informed regulation for NPPs. Furthermore, it is interesting to note that the seismic safety importance of relevant facilities of NPP were reclassified and that earthquake-induced events such as soil failures, tsunami and etc. were taken into consideration in the seismic safety evaluation, while these events had not been stated in the guideline so far.

5 4. SEISMIC DESIGN QUALIFIATION OF NPP AFTER SERIOUS EVENTS 4.1. Seismic Back-check of Existing NPPs (NSC, 2006) The Nuclear Safety Commission in Japan issued the recommendation on seismic re-evaluation of existing NPPs based on the revised seismic design guide revised in 2006, which is often called back-checks (NSC, 2006). NSC requested NISA to instruct the electric utilities to evaluate seismic safety of their NPP. In the back-checks, especially the following five issues have been focused, 1) detailed site investigation, 2) re-construction of design basis ground motion Ss, 3) re-assessment of seismic safety, 4) implementation of stability analysis of soil ground and 5) assessment of earthquake-induced tsunami. Back-checks for all existing NPPs in Japan had been done from Then, it has taken much time and effort to determine the design ground motions of other existing NPPs in Japan since the revised guide did not describe practical procedures on the determination of the DBGM. In July 2007, the Niigata earthquake hit the Kasiwazaki-Kariwa NPP, which raised the complex problem on why such large ground motions were observed on the base-mat of reactors at the Kashiwazaki site. NISA investigated the cause and finally concluded that the problem might be related to evaluation and quantification of faults near the site, which made the back-check process much slower than before. In September 2009, the back-checks have been started by NISA, and a reactor No.7 in the Kashiwazaki plant was restarted at the end of 2009, which was 2.5 years after the Niigata earthquake. All existing NPPs in other sites in Japan have been re-evaluated on the basis of revised design as well as the key points reflecting the lessons learned from the Niigata Earthquake. From half year later after the Fukushima accident, the back-checks has been made until now. Currently, a special committee has been formed in NSC to identify issues to be reflected on the regulatory guide for reviewing seismic design of NPPs taking into account the knowledge gained from the 2011 Tohoku Earthquake and subsequent tsunami Japanese Stress Test after Fukushima Event After the Fukushima accident of March 2011, Japanese Government, taking it serious that the general public and local residents are doubtful about safety of all existing NPPs in Japan, the NSC issued the letter to the Ministry of Economy, Trade and Industry (METI) on Implementation of comprehensive safety review of existing NPPs based on insights from the accident at the Fukushima Daiichi NPP of the TEPCO on July 11, Then, NISA implemented a so-called stress test introduced by European countries with regard to the restarting of operations at NPPs. There are two levels of safety assessment, primary and secondary, which are, respectively, related to decision on whether to restart operations at NPPs not in operation and to decision on whether to continue and halt operations at NPPs in operation. Kansai Electric Power Company submitted the result of the stress test for Nos. 3 and 4 Unit of Ohi NPP in the end of October 2011, then NISA has started to review the result. It was initially claimed that the stress test might not provide sufficient reasons for nuclear safety since the safety issue were directly linked to the condition of restarting operation and judging criteria associated with the result of the primary assessment were not clear. In January 2012, NISA has approved that the safety of the plants are ensured against the earthquakes and tsunami similar to those attacking the Fukushima Daiichi NPP. Final decision on restarting operations of the Ohi NPP has not been made because the general public and local governments do not accept the restarting operation. Besides the Ohi plants, the primary assessment results of more than ten other NPPs have been submitted to NISA. There are no results of secondary assessment reported now.

6 5. DESIGN IMPACT AND FUTURE RESEARCH NEEDS 5.1 Risk concept for earthquake and tsunami The current seismic design review guideline has introduced residual risk which allows a small probability that the seismic design ground motion is exceeded during the plant life. This is indeed an important paradigm shift in the revision, while the old guideline had required only absolute safety for nuclear power facilities. This new concept residual risk, however, has not been intensively implemented regarding how to treat it, how to assess it, and how to utilize it after no intensive discussion has been made since the revision of the guideline. Another important point of the 2006 revision of the seismic design review guideline is to state an inclusion of earthquake-induced phenomena, i.e., slope failures and tsunamis. If the latter phenomenon was treated properly, we might have avoided the serious accident of the Fukushima Daiichi NPP. The current guideline clearly states to make every effort to reduce any residual risks that still exist beyond the design basis, which has originally been proposed for the provision of setting the design basis seismic ground motion Ss. The same concept should be applied to the residual risk due to tsunami beyond the design basis. There could be variety of measures to reduce the residual risk due to future tsunamis. A fundamental treatment should be, of course, based on the concept of defense in depth, i.e., prevention of initiation of accidents, prevention of development of accidents and mitigation of consequence due to the accidents. One of practical but effective risk evaluation is implementation of a tsunami PSA, similar to seismic PSA, which in principle consists of a tsunami hazard assessment, a fragility evaluation and CDF (Core Damage Frequency) estimation of an NPP. The fragility of NPP systems against tsunamis should cover mechanical failure, electrical component failure due to inundation, both of which require extensive and detail information and technical lessons from the Fukushima event Performance-based Seismic Design Japanese seismic design review guideline for Nuclear Power Facilities (NSC, 2006) states that reflecting the fundamental performance requirement of NP facilities should be avoidance of any risks of serious radiological exposure to the public in the vicinity of the facilities, as is shown in the above. More concretely, to ensure safety of NPP, the primary requirement are to stop, to cool down a reactor and to confine all radioactive materials within a reactor. Unfortunately, these fundamental requirements could not be accomplished at the event of Fukushima Daiichi NPP. The seismic design guide of NPPs has been compiled, of course, to ensure the safety of the plants which are associated with radioactive material release outside the plant as a top priority. The Niigata earthquake event, however, clearly shows that plant serviceability related to immediate recovery of the plant for stable constant generation of electricity to the society, since all units in the Kashiwazaki-Kariwa plants have been stopped for almost two years after the event. Therefore, the required various performance of NPPs during/after earthquakes should be listed up and be studied for establishment of future performance-based seismic design of NPPs. The serviceability of NPP will be one of important research subjects which can be spread out from plant level to structures, components levels Seismic safety margin from PSA perspective (Takada, 2008) Seismic Probabilistic Safety Assessment (SPSA) were initiated in the US in 1980 s and intensively implemented for all NPPs in the US as Individual Plants Examination of External Events (IPEEE) program. In 2007, Atomic Energy Society of Japan (JAE) has published the standard for procedure of SPSA for nuclear power plants 2007 (JAE, 2007). The SPSA, in general, treats plant seismic safety margin as a whole where the margin has two different aspects; the margin associated with the design external force due to earthquakes and the margin associated with structures and components capacity. The former can be quantified by comparing the result from the probabilistic seismic hazard analysis

7 and the design ground motion level, while the latter can be estimated by the respective fragility information and design criteria. Figure 4 illustrated the ground motion hazard curve S and the design level s d and the component fragility R and design criteria r d. S R Figure 4. Schematic seismic margin (Takada, 2008) From the figure, it is easily understood how much safety margin of both design forces and component criteria have been set. This way of understanding of seismic margins intentionally or unintentionally set in the seismic design of NPPs can clearly separate the total seismic margin which the plants potentially possesses New Concept for Safer NPPs As is mentioned earlier, the notable characters of the disaster due to the 2011 Great East Japan Earthquake are the followings. One is that the devastated area is very wide, say, 500 km long coastal area which was heavily affected and simultaneously damaged by the huge tsunami. The other is the disaster compound with a huge earthquake and the following tsunami. Focusing on the Fukushima Daiichi NP, the earthquake ground motion with the same order of ground motion intensity level as the design level hit the wide region, by which non-critical facilities, off-site power supply, access roads to the site, etc. were heavily and simultaneously damaged in a relatively wide region surrounding the site. The report says the Fukushima accident occurred due to the loss of all off-site electrical supply, main cause was an excessive shaking and tsunami inundation, which is a quite severe combination which was not intensively been taken into consideration at the design stage around 40 years ago. A special accident investigation committee on the accident at the Fukushima plant chaired by Hatamura submitted an intermediate report on the accident (Investigation Committee on the Accident at the Fukushima Nuclear Power Stations of TEPCO, 2011). Dislike the random failure of electrical devices, the earthquake and tsunami generally affect a wide region where we cannot rely on any emergency aid from the surrounding area because those area are also equally affected at the same time. Secondly, most of NPPs locate only the sea shore lines in Japan, were struck by the huge earthquake with the earthquake magnitude of nine and the tsunami wave following after forty minutes later in the Fukushima site. Then, off-site electric power supply was down, and plant emergency diesel generators were activated, but tsunami wave with 14 meter height disabled the diesel generators and seawater pumps. Finally, the plant failed to cool down the four reactors. Despite the desperate recovery emergency activity, radioactive materials have been released from the reactor. These series of time-dependent transition plant state have been made in the plant. Many operators intervention control were done; automatically shutting down the reactor, electric supply immediately switched to the battery, then automatically DG were activated, after approximately 40 minutes from the main shock, a huge tsunami inundated the facilities and sea-water operated pumps located at the lower floor of the turbine building closer to the seashore. Finally the plant became in the state of SBO (Station-Black-Out), which was the direct cause of the following hydrogen explosion. From this observation of the accident, the physical state of all plants at Fukushima Daiichi site had been transitioned very quickly in time. For each time instant, the most appropriate action to be taken were not the same to prevent the worst scenario of the NPP. In other words, the risk itself possesses time-dependent nature, involving human actions and non-static hazard.

8 From the above-mentioned feature of the Fukushima accident, new concept extended from the risk concept such as simultaneous failures, i.e., common cause failure and temporal evolution of failure, equivalently, time-dependent risk evolution are needed. It can be claimed that modern engineering systems possess multiple functions rather than a single function, their system configuration are no more a single element constituent than complex systems, and their systems are not independent but mutually dependent and inter-related systems. Namely, a very complex system assembled or integrated by many dependent subsystems. Consequently, safety of such modern systems should be evaluated in much more integrated and multi-disciplinary approach, which does not seem to be the one in the past. To incorporate the above into the engineering activities, the following new concept has been named by Shibata and been proposed as concept of safety burst by the authors (Takada, 2005). Safety burst, a quite new word, was clearly defined as in the following. Safety burst indicates the physical state that after either a single failure of a part or simultaneous failures of portions of a huge, complex engineering system with possible large failure consequence is initiated, further damage is propagating and extending and finally the expected performance of the system becomes out of control. The report shows some past examples: black out of North America in 2003, an accident of JCO in Tokai village in 1999, fire of subway trains in Seoul in 2003, etc. All of accidents are related to huge modern engineering systems and human activities. Figure 5 shows the new concept related to the safety burst, in which key words are shown in the two categories; chain-reaction type and simultaneous failure. The former is progressive failure of system, which can be understood by using resilience which originally means elasticity, vitality and capability of immediate recovery against external disturbance. By definition, the system should be Chain-reaction (temporal) Simultaneous (spatial) Fail-safe Self-sustainedness Defense in Depth ET/FT Robustness Resilience Timedependent analysis Successive prediction Region problems - block partionning - mutual support - mutual cooperation Figure 5. New concepts related to safety burst resilient. It means that even if the system is damaged, it is easy to recover, which is indeed the extension of risk concept into the one in time domain. The resilience may be related to dynamic risk management strategy, FT/ET analyses, all of which is implemented in a time domain. The robustness, which is recently often used, describes how strong, insensitive, stable and stiff a system is. If we consider all wider regional infrastructure system including power plants as a huge complex system, simultaneous failures occurring in more than two places drastically reduce the preventive measure against common disturbances such as earthquakes or tsunami like natural hazards.

9 Indeed, earthquakes can shake very wide regions simultaneously. It is so called common cause failure in engineering systems. The relevant concept is a fail-safe system, defense in depth, etc. This category is related to the risk in spatial domain. 6. CONCLUSIONS After these serious experiences, seismic design, anti-tsunami design as well as safety assessment have been of major concern, and regulatory authorities, utilities and scientists have been intensively working on seismic qualification of existing NPPs. Various activities from 2006 to the present have been introduced in this paper. In order to ensure higher safety of NPPs, there is clearer paradigm shift from the past engineering discipline that NPPs are to be designed to prevent any accidents to the new discipline that they are to be designed to mitigate accidents, based on the risk concept. And further extension of the risk concept, robustness and resilience are emphasized in this paper. This concept is necessary for modern engineering systems such as NPPs, which are typically multi-functional, mutually dependent complex systems. REFERENCES ADEP (2011). Acceleration observed taken from ADEP web page, 2011 Atomic Energy Society of Japan (JAE) (2007). Standard for procedure of SPSA for nuclear power plants 2007 Atomic Energy Society of Japan (JAE) (2011). Standard for procedure of Probabilistic Risk Assessment against Tsunami for nuclear power plants 2011 (AESJ-SC-RK004:2011) (in Japanese) ERI (2011). Location of Aftershocks taken from Earthquake Research Institute Web page of the University of Tokyo, 2011 IAEA (2003). Seismic Design and Qualification for Nuclear Power Plants, Safety Guide, NS-G-1.6, IAEA SAFETY ATANDARDS SERIES Investigation Committee on the Accident at the Fukushima Nuclear Power Stations of TEPCO (2011). Interim Investigation report, chaired by H. Hatamura, Dec. 26, 2011, Joint Investigation group of the Tohoku earthquake and Tsunami, 2011 Kato, M. (1989). Review of revised Japanese seismic guideline for NPP design, Nuclear Engineering and Design 114, pp Nuclear Safety Commission of Japan (2006). Revision of Regulatory Guide for Reviewing Seismic Design of Nuclear Power Reactor Facilities, NSC Nuclear Safety Commission of Japan (2006). Seismic re-evaluation (back-checks) recommended on existing NPPs based on the revised seismic design guide, NSC Nuclear Safety Commission of Japan (2006). Revision of Regulatory Guide for Reviewing Seismic Design of Nuclear Power Reactor Facilities, NSC Nuclear Safety Commission of Japan (2006). Seismic Re-evaluation (back-checks) recommended on Existing NPPs based on the revised seismic design guide, NSC Takada, T. (2005). ''Safety Burst'', WG report, EAJ Information No.121, March 2005 (in Japanese) Takada, T. (2008). Seismic PSA and Recent Earthquake Event in Nuclear Industry in Japan, Vol. 7, No.2, Maintenology (in Japanese) Takada, T. (2010). Revised Seismic Design Guideline for NPPS and Impact of 2007 Niigata Earthquake, Codes in Structural Engineering, Joint IABSE-fib Conference, Dubrovnic, May 3-5 Takada, T. (2011). What Engineering should be after the Unprecedented Disaster, WG for Emergency Engineering Vision, Scholl of Engineering, The University of Tokyo Takada, T. (2012). Robustness and Resilience as Extension of Risk Concept After Fukushima Event, One-year After the Great East Japan Earthquake International Symposium on Engineering Lessons learned from the Giant Earthquake, JAEE, Tokyo